A stack-based buffer overflow in Bimesoft SurfOffline Professional 2.2.0.103 allows an unauthenticated attacker to crash the application via a malformed project name.

The application utilizes a structured exception handler (SEH) which is susceptible to overflow when processing excessively long project name inputs. An unauthenticated attacker can supply a crafted payload to overwrite SEH registers, leading to a denial of service condition.

The exploitation of this vulnerability results in a denial of service, rendering the software unusable for the end user. While the CVSS score of 7.5 highlights a significant risk to availability, the primary impact is localized to the workstation or server hosting the application, causing potential operational disruption.

Immediate Action: As there is no official patch available from the vendor, users should exercise caution when inputting project names and avoid processing untrusted or malformed data within the application.

Proactive Monitoring: Monitor system event logs and application crash reports for unexpected terminations that coincide with user input actions.

Compensating Controls: Ensure that the application is executed with the least privilege necessary to limit the potential impact of an application crash on the broader host operating system.

Public Exploit Available: Yes, a proof-of-concept exploit is available via the Exploit Database (EDB-ID 47795).

Given the availability of a public proof-of-concept, users of SurfOffline Professional 2.2.0.103 are at risk of service disruption. Since no vendor patch is available, administrators should prioritize restricting the use of the software to trusted environments or identifying alternative solutions if high availability is a critical requirement.